Hi, thanks for your report.
On Tue, 06 Aug 2019 01:58:43 +1100 Dev <d...@heavenfactory.com> wrote: > Arpwatch not working properly (bug) on Debian 10.0 (Buster) > (...) There has been an intentional change on how arpwatch is started in buster. From the NEWS file (you should have seen the content of this during the upgrade): Starting with version 2.1a15-3, arpwatch ships with systemd unit files. The change requires manual steps after the upgrade. The `/etc/arpwatch.conf` file, which can be used to specify different configuration options for multiple interface, is replaced by individual configuration files for each interface. If you have configured arpwatch using `/etc/arpwatch.conf` file, you need to convert this to the new format. See `/etc/arpwatch/README` for details. After the upgrade, arpwatch will not be started by default. You need to specify the interface(s) to run on, see `/etc/default/arpwatch` for instructions. If your database file in `/var/lib/arpwatch/` is called `arp.dat` you need to rename it to `IFACE.dat` (where IFACE is the name of the interface you configured arpwatch to run on) if you want to keep your current arp database. Also, make sure to drop the `-i` option from ARGS if you were using that to specify the interface. The instructions from /etc/default/arpwatch that have already been quoted in this bug are: # when using systemd you have to enable arpwatch explicitly for each # interface you want to run it on by running: # systemctl enable arpwatch@IFACE # systemctl start arpwatch@IFACE > 1) File " /VAR/LIB/ARPWATCH/ARP.DAT " is not created > (...) > 2) /etc/init.d/arpwatch status display "service is running" but it's > not running > (...) Reverting the changes you made to the systemd unit file and following the instructions above to enable arpwatch on the interface(s) you want should solve both your issues. Regards Lukas